Security checklist

Before production

Complete every control below for each external service and environment.

• Use HTTPS and reject redirects to an unapproved host.
• Keep all API keys and signing secrets in a server-side secret manager.
• Verify HMAC before JSON parsing.
• Reject CRM webhook timestamps more than five minutes from current time.
• Atomically claim every delivery ID before side effects.
• Validate installation, account, site, and external-record relationships.
• Use separate credentials for development, staging, and production.
• Retain only fields required by the customer's active mapping.
• Redact secrets, visitor content, and raw provider bodies from logs.
• Document rotation, disabling, and deletion procedures.

Tenant-isolation test

Create two test accounts with separate sites and credentials. Prove that each credential can access only its own site, that mixed site and ticket IDs fail, and that middleware records remain scoped by the full installation relationship.

1. 1Call Site A with Key A and confirm success.
2. 2Call Site B with Key A and confirm 401 or non-disclosing failure.
3. 3Request a Site B ticket through Site A and confirm 404.
4. 4Send a valid signed CRM delivery for Installation A and confirm it writes only to A's connection.
5. 5Change the installation, site, or external record identifier and confirm rejection.
6. 6Revoke Key A and confirm it can no longer read or write.

Incident response

Disable the affected integration, preserve safe request and delivery IDs, rotate the credential, identify the affected tenant and operations, correct the cause, run isolation tests, and re-enable only after a signed test succeeds.